Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CSA does not Query User every time.

We have been tasked to have a pop up (User Query) every time someone writes to a removable disk. We have the rule working, but it does not pop up every time a file is written. There seems to be a set time between pop ups. Is there a way to adjust that time? Can it be set to pup up every time someone writes to removable media?

4 REPLIES
New Member

Re: CSA does not Query User every time.

Hi Craig,

User queries are cached for 1 hour and that timer cannot be changed. However, you could modify the query so that it's unique each time which would cause the popup to come back. I'd recommend using the @filename cookie in your query response which should pop the query again when a different file is written to removable media.

Thanks,

Josh

New Member

Re: CSA does not Query User every time.

Thank you Josh. Had that in place. I am disappointed the 1 hour timer isn't adjustable. That and the 256 character count for the query.

Blue

Re: CSA does not Query User every time.

You might be able to use a DAC or set rule to add files to an application class when written to removable drives.

You can also just log it. Create a file set with @removable and create a FAC rule and set the action to monitor to log when any application writes to that fileset.

Tom

Re: CSA does not Query User every time.

You should be very carefull with trying to get it to popup everytime someone accesses a single file from the same app. It could cause large amounts of popups and cpu usage to do this. Just a word of caution

133
Views
4
Helpful
4
Replies